PT-2026-36007 · Freebsd · Freebsd+1

Mariusz Zaborski · Published 2026-04-29 · Updated 2026-05-12 · CVE-2026-35547

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreeBSD (affected versions not specified)

Description When processing the header of an incoming message, libnv fails to properly validate the message size. This lack of validation allows a malicious program to write outside the bounds of a heap allocation, which is a heap buffer overflow (a condition where data exceeds the allocated memory buffer on the heap). This can trigger a crash or system panic, and may allow an unprivileged user to elevate their privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

CWE-130

Related Identifiers

CVE-2026-35547

Affected Products

Freebsd

Libnv

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-35547 · Security Note
• https://security.freebsd.org/advisories/FreeBSD-SA-26:17.libnv.asc · Vendor Advisory
• https://twitter.com/lyrie_ai/status/2054090758127251876 · Twitter Post
• https://t.me/CVEtracker/52297 · Telegram Post
• https://twitter.com/lyrie_ai/status/2054090758999724065 · Twitter Post
• https://freebsd.org/security/advisories/FreeBSD-SA-26:17.libnv.asc · Note
• https://reddit.com/r/freebsd/comments/1sz8nr3/20260429_brings_six_new_security_advisories_three · Reddit Post
• https://twitter.com/VulmonFeeds/status/2049798135619142030 · Twitter Post
• https://twitter.com/vuldb/status/2049800072767160732 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054090757271679260 · Twitter Post